<!DOCTYPE html>
<html lang="en">
<head>

    <meta charset="utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />

    <title>Threat Alert: Log4j Vulnerability Has Been adopted by two Linux Botnets</title>
    <meta name="HandheldFriendly" content="True" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <link rel="stylesheet" type="text/css" href="/assets/built/screen.css?v=db215a41fd" />

    <link rel="shortcut icon" href="/favicon.png" type="image/png" />
    <link rel="canonical" href="https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/" />
    <meta name="referrer" content="no-referrer-when-downgrade" />
    <link rel="amphtml" href="https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/amp/" />
    
    <meta property="og:site_name" content="360 Netlab Blog - Network Security Research Lab at 360" />
    <meta property="og:type" content="article" />
    <meta property="og:title" content="Threat Alert: Log4j Vulnerability Has Been adopted by two Linux Botnets" />
    <meta property="og:description" content="The Log4j vulnerability that came to light at the end of the year can
undoubtedly be considered a major event in the security community. Honeypot and
botnet are our bread and butter, and we have been concerned about which botnets
would be exploiting this since the vulnerability was made public. This morning
we got the first answers, our Anglerfish and Apacket honeypots have caught 2
waves of attacks using the Log4j vulnerability to form botnets, and a quick
sample analysis showed that they were " />
    <meta property="og:url" content="https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/" />
    <meta property="article:published_time" content="2021-12-11T14:28:41.000Z" />
    <meta property="article:modified_time" content="2021-12-11T14:28:41.000Z" />
    <meta property="article:tag" content="Botnet" />
    
    <meta name="twitter:card" content="summary" />
    <meta name="twitter:title" content="Threat Alert: Log4j Vulnerability Has Been adopted by two Linux Botnets" />
    <meta name="twitter:description" content="The Log4j vulnerability that came to light at the end of the year can
undoubtedly be considered a major event in the security community. Honeypot and
botnet are our bread and butter, and we have been concerned about which botnets
would be exploiting this since the vulnerability was made public. This morning
we got the first answers, our Anglerfish and Apacket honeypots have caught 2
waves of attacks using the Log4j vulnerability to form botnets, and a quick
sample analysis showed that they were " />
    <meta name="twitter:url" content="https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/" />
    <meta name="twitter:label1" content="Written by" />
    <meta name="twitter:data1" content="RootKiter" />
    <meta name="twitter:label2" content="Filed under" />
    <meta name="twitter:data2" content="Botnet" />
    <meta name="twitter:site" content="@360Netlab" />
    <meta name="twitter:creator" content="@RooKiter" />
    
    <script type="application/ld+json">
{
    "@context": "https://schema.org",
    "@type": "Article",
    "publisher": {
        "@type": "Organization",
        "name": "360 Netlab Blog - Network Security Research Lab at 360",
        "logo": "https://blog.netlab.360.com/content/images/2019/02/netlab-brand-5.png"
    },
    "author": {
        "@type": "Person",
        "name": "RootKiter",
        "image": {
            "@type": "ImageObject",
            "url": "https://blog.netlab.360.com/content/images/2017/04/--.png",
            "width": 245,
            "height": 233
        },
        "url": "https://blog.netlab.360.com/author/rootkiter/",
        "sameAs": [
            "http://rootkiter.com",
            "https://twitter.com/RooKiter"
        ]
    },
    "headline": "Threat Alert: Log4j Vulnerability Has Been adopted by two Linux Botnets",
    "url": "https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/",
    "datePublished": "2021-12-11T14:28:41.000Z",
    "dateModified": "2021-12-11T14:28:41.000Z",
    "keywords": "Botnet",
    "description": "The Log4j vulnerability that came to light at the end of the year can\nundoubtedly be considered a major event in the security community. Honeypot and\nbotnet are our bread and butter, and we have been concerned about which botnets\nwould be exploiting this since the vulnerability was made public. This morning\nwe got the first answers, our Anglerfish and Apacket honeypots have caught 2\nwaves of attacks using the Log4j vulnerability to form botnets, and a quick\nsample analysis showed that they were ",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://blog.netlab.360.com/"
    }
}
    </script>

    <script src="/public/ghost-sdk.min.js?v=db215a41fd"></script>
<script>
ghost.init({
	clientId: "ghost-frontend",
	clientSecret: "2a7213b591a9"
});
</script>
    <meta name="generator" content="Ghost 2.13" />
    <link rel="alternate" type="application/rss+xml" title="360 Netlab Blog - Network Security Research Lab at 360" href="https://blog.netlab.360.com/rss/" />
    
<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-83587830-1', 'auto');
  ga('send', 'pageview');

</script>

<!-- Fix first paragraph font size -->
<style type="text/css">
 .post-template .post-content > p:first-child {font-size: 1em;}
</style>

</head>
<body class="post-template tag-botnet">

    <div class="site-wrapper">

             <header
    class="site-header outer">
    <div class="inner">
        <nav class="site-nav">
    <div class="site-nav-left">
                <a class="site-nav-logo" href="https://blog.netlab.360.com"><img src="https://blog.netlab.360.com/content/images/2019/02/netlab-brand-5.png" alt="360 Netlab Blog - Network Security Research Lab at 360" /></a>
            <ul class="nav" role="menu">
    <li class="nav-botnet" role="menuitem"><a href="https://blog.netlab.360.com/tag/botnet/">Botnet</a></li>
    <li class="nav-dnsmon" role="menuitem"><a href="https://blog.netlab.360.com/tag/dnsmon/">DNSMon</a></li>
    <li class="nav-ddos" role="menuitem"><a href="https://blog.netlab.360.com/tag/ddos/">DDoS</a></li>
    <li class="nav-passivedns" role="menuitem"><a href="https://blog.netlab.360.com/tag/pdns/">PassiveDNS</a></li>
    <li class="nav-marai" role="menuitem"><a href="https://blog.netlab.360.com/tag/mirai/">Marai</a></li>
    <li class="nav-dta" role="menuitem"><a href="https://blog.netlab.360.com/tag/dta/">DTA</a></li>
</ul>

    </div>
    <div class="site-nav-right">
        <div class="social-links">
                <a class="social-link social-link-tw" href="https://twitter.com/360Netlab" title="Twitter" target="_blank" rel="noopener"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M30.063 7.313c-.813 1.125-1.75 2.125-2.875 2.938v.75c0 1.563-.188 3.125-.688 4.625a15.088 15.088 0 0 1-2.063 4.438c-.875 1.438-2 2.688-3.25 3.813a15.015 15.015 0 0 1-4.625 2.563c-1.813.688-3.75 1-5.75 1-3.25 0-6.188-.875-8.875-2.625.438.063.875.125 1.375.125 2.688 0 5.063-.875 7.188-2.5-1.25 0-2.375-.375-3.375-1.125s-1.688-1.688-2.063-2.875c.438.063.813.125 1.125.125.5 0 1-.063 1.5-.25-1.313-.25-2.438-.938-3.313-1.938a5.673 5.673 0 0 1-1.313-3.688v-.063c.813.438 1.688.688 2.625.688a5.228 5.228 0 0 1-1.875-2c-.5-.875-.688-1.813-.688-2.75 0-1.063.25-2.063.75-2.938 1.438 1.75 3.188 3.188 5.25 4.25s4.313 1.688 6.688 1.813a5.579 5.579 0 0 1 1.5-5.438c1.125-1.125 2.5-1.688 4.125-1.688s3.063.625 4.188 1.813a11.48 11.48 0 0 0 3.688-1.375c-.438 1.375-1.313 2.438-2.563 3.188 1.125-.125 2.188-.438 3.313-.875z"/></svg>
</a>
        </div>
            <a class="rss-button" href="https://feedly.com/i/subscription/feed/https://blog.netlab.360.com/rss/" title="RSS" target="_blank" rel="noopener"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><circle cx="6.18" cy="17.82" r="2.18"/><path d="M4 4.44v2.83c7.03 0 12.73 5.7 12.73 12.73h2.83c0-8.59-6.97-15.56-15.56-15.56zm0 5.66v2.83c3.9 0 7.07 3.17 7.07 7.07h2.83c0-5.47-4.43-9.9-9.9-9.9z"/></svg>
</a>
    </div>
</nav>
    </div>
    </header>


    <main id="site-main" class="site-main outer">
        <div class="inner">

            <article class="post-full post tag-botnet no-image">

                <header class="post-full-header">
                    <section class="post-full-meta">
                        <time class="post-full-meta-date" datetime="2021-12-11">11 December                            2021</time>
                        <span class="date-divider">/</span> <a href="/tag/botnet/">Botnet</a>
                    </section>
                    <h1 class="post-full-title">Threat Alert: Log4j Vulnerability Has Been adopted by two Linux Botnets</h1>
                </header>


                <section class="post-full-content">
                    <div class="post-content">
                        <p>The Log4j vulnerability that came to light at the end of the year can undoubtedly be considered a major event in the security community.  Honeypot and botnet are our bread and butter, and we have been concerned about which botnets would be exploiting this since the vulnerability was made public. This morning we got the first answers, our Anglerfish and Apacket honeypots have caught 2 waves of attacks using the Log4j vulnerability to form botnets, and a quick sample analysis showed that they were used to form Muhstik and Mirai botnets respectively, both targeting Linux devices.</p>
<h2 id="sampleanalysis">Sample Analysis</h2>
<h3 id="mirai">MIRAI</h3>
<p>This wave propagates a new variant of miria, which has made the following changes compared to the initial code.</p>
<ol>
<li>
<p>table_init/table_lock_val/table_unlock_val and other mirai-specific configuration management functions have been removed.</p>
</li>
<li>
<p>The attack_init function is also discarded, and the ddos attack function is called directly by the command processing function.</p>
</li>
</ol>
<p>Also, a uy top-level domain is chosen for its C2 domain name, which is also rare.</p>
<h3 id="muhstik">Muhstik</h3>
<p>Muhstik, a botnet we disclosed in <a href="(https://blog.netlab.360.com/botnet-muhstik-is-actively-exploiting-drupal-cve-2018-7600-in-a-worm-style/)">2018</a>, is a variant of Tsunami that borrows from the Mirai code. In this captured sample, we note that the new Muhstik variant adds a backdoor module, ldm, which has the ability to add an SSH backdoor public key with the following installed backdoor public key.</p>
<pre><code>ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQBtGZHLQlMLkrONMAChDVPZf+9gNG5s2rdTMBkOp6P7mKIQ/OkbgiozmZ3syhELI4L0M1TmJiRbbrIta8662z4WAKhXpiU22llfwrkN0m8yKJApd8lDzvvdBw+ShzJr+WaEWX7uW3WCe5NCxGxc6AU7c2vmuLlO0B203pIGVIbV1xJmj6MXrdZpNy7QRo9zStWmgmVY4GR4v26R3XDOn1gshuQ6PgUqgewQ+AlslLVuekdH23sLQfejXyJShcoFI6BbH67YTcoh4G/TuQdGe8lIeAAmp7lzzHMyu+2iSNoFFCeF48JSA2YZvssFOsGuAtV/9uPNQoi9EyvgM2mGDgJ
</code></pre>
<p>After the public key is added to the ~/.ssh/authorized_keys file, the attacker can directly log into the remote server without password authentication.</p>
<p>Considering the special vulnerability mechanism of log4j2, Muhstik takes a blunt approach to spread the payload aimlessly knowing that there will be vulnerable machines, and in order to know who has been infected, Muhstik adopts TOR network for its reporting mechanism.</p>
<p>Before accessing the TOR network, Muhstik queries relay.l33t-ppl.inf through some publicly available DoH services(see the list beflow). During this process, a number of DNS requests are generated. Note: The following domains are not C2 domains but DoH service providers, depends on the situation, readers might be able to use the list to crosscheck their network for possible infections if they are not expect DoH usage on their network.</p>
<pre><code>doh.defaultroutes.de
dns.hostux.net
dns.dns-over-https.com
uncensored.lux1.dns.nixnet.xyz
dns.rubyfish.cn dns.twnic.tw
doh.centraleu.pi-dns.com
doh.dns.sb doh-fi.blahdns.com
fi.doh.dns.snopyta.org
dns.flatuslifir.is
doh.li
dns.digitale-gesellschaft.ch
</code></pre>
<p>When it is not possible to report infect information directly from the TOR network, Muhstik will try to use  TOR's public mapped domains, the list of relevant domains is as follows</p>
<pre><code>bvprzqhoz7j2ltin.onion.ws
bvprzqhoz7j2ltin.onion.ly
bvprzqhoz7j2ltin.tor2web.s
</code></pre>
<p>Muhstik's ELF sample has the following codes.：<br>
<img src="https://blog.netlab.360.com/content/images/2021/12/tsunami_command-1-1.png" alt="tsunami_command-1-1"></p>
<p>We can see that the sample supports DDoS and backdoor commands. The C2 of the sample is stored in a mirai-style configuration with the following configuration information in plain text.：</p>
<pre><code> [0x02]: &quot;listening tun0\x00&quot;, size=15
 [0x03]: &quot;irc.de-za&quot;\x1f\x90&quot;listening tun0\x00&quot;l&quot;, size=30
 [0x04]: &quot;\x1f\x90&quot;, size=2
 [0x05]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x06]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x07]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x08]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x0a]: &quot;/proc/\x00&quot;, size=7
 [0x0c]: &quot;/exe\x00&quot;, size=5
 [0x0d]: &quot;/status\x00&quot;, size=8
 [0x0e]: &quot;/fd\x00&quot;, size=4
 [0x0f]: &quot;\x58\x4D\x4E\x4E\x43\x50\x46\x22\x00&quot;, size=33
 [0x10]: &quot;zollard\x00&quot;, size=8
 [0x11]: &quot;muhstik-11052018\x00&quot;, size=17
 [0x12]: &quot;\x02^nL\x0b\x1a\x06_nL\x02\x0f\x00&quot;, size=13
 [0x13]: &quot;eth1\x00&quot;, size=5
 [0x14]: &quot;lan0\x00&quot;, size=5
 [0x15]: &quot;-\x00&quot;, size=2
 [0x16]: &quot;eth0\x00&quot;, size=5
 [0x17]: &quot;inet0\x00&quot;, size=6
 [0x18]: &quot;lano\x00&quot;, size=5
 [0x19]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x1a]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x1b]: &quot;d4cf8e4ab26f7fd15ef7df9f7937493d\x00&quot;, size=33
 [0x1c]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x1d]: &quot;37.44.244.124\x00&quot;, size=14
 [0x1e]: &quot;37.44.244.124\x00&quot;, size=14
 [0x1f]: &quot;37.44.244.124\x00&quot;, size=14
 [0x20]: &quot;37.44.244.124\x00&quot;, size=14
 [0x21]: &quot;37.44.244.124\x00&quot;, size=14
 [0x22]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x23]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
</code></pre>
<p>The <code>log.exposedbotnets.ru</code> is C2, which resolves to <code>37.44.244.124</code>. The author registered a domain starting with log perhaps intentionally to fit the Log4j vulnerability.</p>
<h2 id="conclusion">Conclusion</h2>
<p>Considering the huge impact of the Log4j vulnerability, we expect more botnets to support it to spread. We will keep an eye on this and will share new observations here.</p>
<h2 id="contactus">Contact us</h2>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab">Twitter</a> or email us to netlab at 360 dot cn.</p>
<h2 id="ioc">IOC:</h2>
<h3 id="mirai">Mirai</h3>
<p>C2:</p>
<pre><code>nazi.uy
</code></pre>
<p>URL:</p>
<pre><code>http://62.210.130.250/lh.sh
http://62.210.130.250:80/web/admin/x86_64
http://62.210.130.250:80/web/admin/x86
http://62.210.130.250:80/web/admin/x86_g
</code></pre>
<h3 id="muhstik">Muhstik</h3>
<p>C2:</p>
<pre><code>log.exposedbotnets.ru
</code></pre>
<p>URL:</p>
<pre><code>http://45.130.229.168:9999/Exploit.class
http://18.228.7.109/.log/log
http://18.228.7.109/.log/pty1;
http://18.228.7.109/.log/pty2;
http://18.228.7.109/.log/pty3;
http://18.228.7.109/.log/pty4;
http://18.228.7.109/.log/pty5;
http://210.141.105.67:80/wp-content/themes/twentythirteen/m8
http://159.89.182.117/wp-content/themes/twentyseventeen/ldm
</code></pre>

                    </div>
                </section>


                <footer class="post-full-footer">


                    <section class="post-full-authors">

    <div class="post-full-authors-content">
        <p>This post was a collaboration between</p>
        <p><a href="/author/rootkiter/">RootKiter</a>, <a href="/author/huiwang/">Hui Wang</a>, <a href="/author/yegenshen/">Genshen Ye</a></p>
    </div>

    <ul class="author-list">
        <li class="author-list-item">

            <div class="author-card">
                <div class="basic-info">
                        <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/04/--.png" alt="RootKiter" />
                    <h2>RootKiter</h2>
                </div>
                <div class="bio">
                        <p>Learning and beating botnet...</p>
                        <p><a href="/author/rootkiter/">More posts</a> by RootKiter.</p>
                </div>
            </div>

                <a href="/author/rootkiter/" class="moving-avatar">
                    <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/04/--.png" alt="RootKiter" />
                </a>

        </li>
        <li class="author-list-item">

            <div class="author-card">
                <div class="basic-info">
                        <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/05/WechatIMG1.jpeg" alt="Hui Wang" />
                    <h2>Hui Wang</h2>
                </div>
                <div class="bio">
                        <p>Read <a href="/author/huiwang/">more posts</a> by this author.</p>
                </div>
            </div>

                <a href="/author/huiwang/" class="moving-avatar">
                    <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/05/WechatIMG1.jpeg" alt="Hui Wang" />
                </a>

        </li>
        <li class="author-list-item">

            <div class="author-card">
                <div class="basic-info">
                        <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/10/1662072805.jpg" alt="Genshen Ye" />
                    <h2>Genshen Ye</h2>
                </div>
                <div class="bio">
                        <p>Read <a href="/author/yegenshen/">more posts</a> by this author.</p>
                </div>
            </div>

                <a href="/author/yegenshen/" class="moving-avatar">
                    <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/10/1662072805.jpg" alt="Genshen Ye" />
                </a>

        </li>

    </ul>

</section>


                </footer>

                <div id="disqus_thread"></div>
                <script>
                    var disqus_config = function () {
                        this.page.url = "https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/";
                        this.page.identifier = "ghost-61b4b2523819e50007636db1"
                    };
                    (function () {
                        var d = document, s = d.createElement('script');
                        s.src = 'https://blog-netlab-360.disqus.com/embed.js';
                        s.setAttribute('data-timestamp', +new Date());
                        (d.head || d.body).appendChild(s);
                    })();
                </script>

            </article>

        </div>
    </main>

    <aside class="read-next outer">
        <div class="inner">
            <div class="read-next-feed">
                <article class="read-next-card"   style="background-image: url(https://blog.netlab.360.com/content/images/size/w600/2019/02/astronomy-constellation-dark-998641-4.jpg)"
                     >
                    <header class="read-next-card-header">
                        <small class="read-next-card-header-sitetitle">&mdash; 360 Netlab Blog - Network Security Research Lab at 360 &mdash;</small>
                        <h3 class="read-next-card-header-title"><a href="/tag/botnet/">Botnet</a></h3>
                    </header>
                    <div class="read-next-divider"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 14.5s2 3 5 3 5.5-2.463 5.5-5.5S21 6.5 18 6.5c-5 0-7 11-12 11C2.962 17.5.5 15.037.5 12S3 6.5 6 6.5s4.5 3.5 4.5 3.5"/></svg>
</div>
                    <div class="read-next-card-content">
                        <ul>
                            <li><a href="/yi-jing-you-xxxge-jia-zu-de-botnetli-yong-log4shelllou-dong-chuan-bo-wei-da-bu-ding-de-gan-jin-liao/">已有10个家族的恶意样本利用Log4j2漏洞传播</a></li>
                            <li><a href="/wei-xie-kuai-xun-log4jlou-dong-yi-jing-bei-yong-lai-zu-jian-botnet-zhen-dui-linuxshe-bei/">威胁快讯：Log4j漏洞已经被用来组建botnet，针对Linux设备</a></li>
                            <li><a href="/warning-ewdoor-botnet-is-attacking-att-customers_cn/">EwDoor僵尸网络，正在攻击美国AT&amp;T用户</a></li>
                        </ul>
                    </div>
                    <footer class="read-next-card-footer">
                        <a href="/tag/botnet/">See all 98 posts →</a>
                    </footer>
                </article>

                <article class="post-card post tag-log4j tag-log4shell tag-botnet tag-anglerfish-honeypot tag-elknot tag-mirai tag-tsunami tag-m8220 tag-xmrig tag-honeypot tag-anglerfish no-image">


    <div class="post-card-content">

        <a class="post-card-content-link" href="/yi-jing-you-xxxge-jia-zu-de-botnetli-yong-log4shelllou-dong-chuan-bo-wei-da-bu-ding-de-gan-jin-liao/">

            <header class="post-card-header">
                    <span class="post-card-tags">Log4j</span>
                <h2 class="post-card-title">已有10个家族的恶意样本利用Log4j2漏洞传播</h2>
            </header>

            <section class="post-card-excerpt">
                <p>背景介绍 2021年12月11号8点整，我们率先捕获到Muhstik僵尸网络样本通过Log4j2 RCE漏洞传播，并首发披露Mirai和Muhstik僵尸网络在野利用详情[1]。 2天来，我们陆续又捕获到其它家族的样本，目前，这个家族列表已经超过10个，这里从漏洞、payload、攻击IP 和样本分析等几个维度介绍我们的捕获情况。 Apache Log4j2 漏洞攻击分布 360网络安全研究院大网蜜罐系统监测到Apache Log4j2 RCE漏洞（CVE-2021-44228）扫描及攻击，源IP地址地理位置分布如下： 国家/地区 攻击源IP数量 Germany 271 The Netherlands 143 China 134</p>
            </section>

        </a>

        <footer class="post-card-meta">

            <ul class="author-list">
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        Ghost
                    </div>

                        <a href="/author/ghost/" class="static-avatar">
                            <img class="author-profile-image" src="https://static.ghost.org/v2.0.0/images/ghost.png" alt="Ghost" />
                        </a>
                </li>
            </ul>

            <span class="reading-time">18 min read</span>

        </footer>

    </div>

</article>

                <article class="post-card post tag-log4j tag-mirai tag-muhstik tag-botnet no-image">


    <div class="post-card-content">

        <a class="post-card-content-link" href="/wei-xie-kuai-xun-log4jlou-dong-yi-jing-bei-yong-lai-zu-jian-botnet-zhen-dui-linuxshe-bei/">

            <header class="post-card-header">
                    <span class="post-card-tags">Log4j</span>
                <h2 class="post-card-title">威胁快讯：Log4j漏洞已经被用来组建botnet，针对Linux设备</h2>
            </header>

            <section class="post-card-excerpt">
                <p>年末曝光的Log4j漏洞无疑可以算是今年的安全界大事了。作为专注于蜜罐和botnet检测跟踪的团队，我们自该漏洞被公开后就一直关注它会被哪些botnet利用。今早我们等来了首批答案，我们的Anglerfish和Apacket蜜罐先后捕获到2波利用Log4j漏洞组建botnet的攻击，快速的样本分析表明它们分别用于组建 Muhstik 和Mirai botnet，针对的都是Linux设备。样本分析 MIRAI 这一波传播的为miria新变种，相比最初代码，它做了如下变动： 移除了 table_init/table_lock_val/table_unlock_val 等mirai特有的配置管理函数。 attack_init 函数也被抛弃，ddos攻击函数会被指令处理函数直接调用。 同时，其C2域名选用了一个 uy 顶级域的域名，</p>
            </section>

        </a>

        <footer class="post-card-meta">

            <ul class="author-list">
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        RootKiter
                    </div>

                        <a href="/author/rootkiter/" class="static-avatar">
                            <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/04/--.png" alt="RootKiter" />
                        </a>
                </li>
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        Hui Wang
                    </div>

                        <a href="/author/huiwang/" class="static-avatar">
                            <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/05/WechatIMG1.jpeg" alt="Hui Wang" />
                        </a>
                </li>
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        Genshen Ye
                    </div>

                        <a href="/author/yegenshen/" class="static-avatar">
                            <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/10/1662072805.jpg" alt="Genshen Ye" />
                        </a>
                </li>
            </ul>

            <span class="reading-time">5 min read</span>

        </footer>

    </div>

</article>

            </div>
        </div>
    </aside>

    <div class="floating-header">
    <div class="floating-header-logo">
        <a href="https://blog.netlab.360.com">
                <img src="https://blog.netlab.360.com/content/images/size/w30/2019/02/netlab_xs-2.png" alt="360 Netlab Blog - Network Security Research Lab at 360 icon" />
            <span>360 Netlab Blog - Network Security Research Lab at 360</span>
        </a>
    </div>
    <span class="floating-header-divider">&mdash;</span>
    <div class="floating-header-title">Threat Alert: Log4j Vulnerability Has Been adopted by two Linux Botnets</div>
    <div class="floating-header-share">
        <div class="floating-header-share-label">Share this <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
    <path d="M7.5 15.5V4a1.5 1.5 0 1 1 3 0v4.5h2a1 1 0 0 1 1 1h2a1 1 0 0 1 1 1H18a1.5 1.5 0 0 1 1.5 1.5v3.099c0 .929-.13 1.854-.385 2.748L17.5 23.5h-9c-1.5-2-5.417-8.673-5.417-8.673a1.2 1.2 0 0 1 1.76-1.605L7.5 15.5zm6-6v2m-3-3.5v3.5m6-1v2"/>
</svg>
</div>
        <a class="floating-header-share-tw" href="https://twitter.com/share?text=Threat%20Alert%3A%20Log4j%20Vulnerability%20Has%20Been%20adopted%20by%20two%20Linux%20Botnets&amp;url=https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/"
            onclick="window.open(this.href, 'share-twitter', 'width=550,height=235');return false;">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M30.063 7.313c-.813 1.125-1.75 2.125-2.875 2.938v.75c0 1.563-.188 3.125-.688 4.625a15.088 15.088 0 0 1-2.063 4.438c-.875 1.438-2 2.688-3.25 3.813a15.015 15.015 0 0 1-4.625 2.563c-1.813.688-3.75 1-5.75 1-3.25 0-6.188-.875-8.875-2.625.438.063.875.125 1.375.125 2.688 0 5.063-.875 7.188-2.5-1.25 0-2.375-.375-3.375-1.125s-1.688-1.688-2.063-2.875c.438.063.813.125 1.125.125.5 0 1-.063 1.5-.25-1.313-.25-2.438-.938-3.313-1.938a5.673 5.673 0 0 1-1.313-3.688v-.063c.813.438 1.688.688 2.625.688a5.228 5.228 0 0 1-1.875-2c-.5-.875-.688-1.813-.688-2.75 0-1.063.25-2.063.75-2.938 1.438 1.75 3.188 3.188 5.25 4.25s4.313 1.688 6.688 1.813a5.579 5.579 0 0 1 1.5-5.438c1.125-1.125 2.5-1.688 4.125-1.688s3.063.625 4.188 1.813a11.48 11.48 0 0 0 3.688-1.375c-.438 1.375-1.313 2.438-2.563 3.188 1.125-.125 2.188-.438 3.313-.875z"/></svg>
        </a>
        <a class="floating-header-share-fb" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/"
            onclick="window.open(this.href, 'share-facebook','width=580,height=296');return false;">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M19 6h5V0h-5c-3.86 0-7 3.14-7 7v3H8v6h4v16h6V16h5l1-6h-6V7c0-.542.458-1 1-1z"/></svg>
        </a>
    </div>
    <progress id="reading-progress" class="progress" value="0">
        <div class="progress-container">
            <span class="progress-bar"></span>
        </div>
    </progress>
</div>




        <footer class="site-footer outer">
            <div class="site-footer-content inner">
                <section class="copyright"><a href="https://blog.netlab.360.com">360 Netlab Blog - Network Security Research Lab at 360</a> &copy; 2021</section>
                <nav class="site-footer-nav">
                    <a href="https://blog.netlab.360.com">Latest Posts</a>
                    
                    <a href="https://twitter.com/360Netlab" target="_blank" rel="noopener">Twitter</a>
                    <a href="https://ghost.org" target="_blank" rel="noopener">Ghost</a>
                </nav>
            </div>
        </footer>

    </div>


    <script>
        var images = document.querySelectorAll('.kg-gallery-image img');
        images.forEach(function (image) {
            var container = image.closest('.kg-gallery-image');
            var width = image.attributes.width.value;
            var height = image.attributes.height.value;
            var ratio = width / height;
            container.style.flex = ratio + ' 1 0%';
        })
    </script>


    <script
        src="https://code.jquery.com/jquery-3.2.1.min.js"
        integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
        crossorigin="anonymous">
    </script>
    <script type="text/javascript" src="/assets/built/jquery.fitvids.js?v=db215a41fd"></script>


    <script>
// Adds delay to author card dropups to disappear. This gives enough
// time for the user to interact with the author card while they move
// the mouse from the avatar to the card. Also makes space for the
// interacted avatar.
$(document).ready(function () {

    var hoverTimeout;

    $('.author-list-item').hover(function(){
        var $this = $(this);

        clearTimeout(hoverTimeout);

        $('.author-card').removeClass('hovered');
        $(this).children('.author-card').addClass('hovered');

    }, function() {
        var $this = $(this);

        hoverTimeout = setTimeout(function() {
            $this.children('.author-card').removeClass('hovered');
        }, 800);
    });

});
</script>

    <script>

        // NOTE: Scroll performance is poor in Safari
        // - this appears to be due to the events firing much more slowly in Safari.
        //   Dropping the scroll event and using only a raf loop results in smoother
        //   scrolling but continuous processing even when not scrolling
        $(document).ready(function () {
            // Start fitVids
            var $postContent = $(".post-full-content");
            $postContent.fitVids();
            // End fitVids

            var progressBar = document.querySelector('#reading-progress');
            var header = document.querySelector('.floating-header');
            var title = document.querySelector('.post-full-title');

            var lastScrollY = window.scrollY;
            var lastWindowHeight = window.innerHeight;
            var lastDocumentHeight = $(document).height();
            var ticking = false;

            function onScroll() {
                lastScrollY = window.scrollY;
                requestTick();
            }

            function onResize() {
                lastWindowHeight = window.innerHeight;
                lastDocumentHeight = $(document).height();
                requestTick();
            }

            function requestTick() {
                if (!ticking) {
                    requestAnimationFrame(update);
                }
                ticking = true;
            }

            function update() {
                var trigger = title.getBoundingClientRect().top + window.scrollY;
                var triggerOffset = title.offsetHeight + 35;
                var progressMax = lastDocumentHeight - lastWindowHeight;

                // show/hide floating header
                if (lastScrollY >= trigger + triggerOffset) {
                    header.classList.add('floating-active');
                } else {
                    header.classList.remove('floating-active');
                }

                progressBar.setAttribute('max', progressMax);
                progressBar.setAttribute('value', lastScrollY);

                ticking = false;
            }

            window.addEventListener('scroll', onScroll, { passive: true });
            window.addEventListener('resize', onResize, false);

            update();

        });
    </script>


    

</body>
</html>
